|
Menu |
|
|
Home |
| |
|
Discussions |
| |
|
Tools |
| |
|
Affiliates |
| |
|
Content |
| |
|
Info |
| | |
|
|
|
|
|
User Info |
|
Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 65
Members: 0
Total: 65
|
|
|
|
|
|
Full disclosure |
|
|
|
|
|
|
|
|
|
IT Security and Insecurity Portal |
|
|
please help me to decode this |
|
Posted: Wed Dec 26, 2012 6:07 pm |
|
|
sarvnaa |
Beginner |
|
|
Joined: Sep 30, 2012 |
Posts: 4 |
|
|
|
|
|
|
|
<?php $sxcxxmrwc="\x6c\x69\x63\x65\x6es\x65\x64";${"\x47L\x4fB\x41LS"}["\x6e\x6a\x62el\x65e\x64"]="\x74\x68\x69\x73s\x73";${"\x47\x4c\x4f\x42ALS"}["\x6cy\x66\x6f\x70x\x69q\x67"]="\x6c\x69c\x65\x6e\x73\x65d";${"GL\x4f\x42A\x4cS"}["\x70j\x78l\x74\x68\x6d"]="\x61r\x72_\x6c\x65\x6eg\x74h";${"G\x4cOB\x41\x4cS"}["y\x79\x75sm\x70\x6d\x6ey"]="s\x74a\x74\x75s";${"G\x4cO\x42\x41\x4c\x53"}["\x69\x74\x78\x72\x77vgi\x62\x63\x72\x76"]="\x64o\x6d\x61\x69\x6e";${"GL\x4f\x42\x41\x4cS"}["\x65\x6a\x6cuk\x76\x70\x68\x69\x6a\x77"]="i";${"\x47\x4cO\x42ALS"}["\x6e\x6f\x63\x62\x6c\x76\x6d\x73qj\x62\x76"]="\x76ide\x6f";${${"G\x4c\x4fBA\x4cS"}["\x69tx\x72\x77\x76\x67\x69\x62\x63\x72\x76"]}=preg_replace("\x2f\x5e(\x2e*\\\x2e)?([\x5e.]*\x5c..\x2a\x29\x24\x2f","\x24\x32",$_SERVER["\x48\x54\x54P\x5f\x48O\x53T"]);${"\x47\x4c\x4f\x42A\x4cS"}["\x6em\x68c\x6b\x78n\x74"]="\x6d\x61\x74\x63h\x65s";${$sxcxxmrwc}="bh\x61r\x61t\x63\x68an\x6e\x65l\x73\x2e\x63o\x6d";${"\x47\x4c\x4f\x42\x41L\x53"}["b\x6cf\x78\x6e\x72\x63\x62wy"]="\x76i\x64\x65o\x5f\x64a\x74a";if(stristr(${${"\x47\x4cOB\x41\x4c\x53"}["\x69\x74\x78r\x77\x76g\x69\x62c\x72\x76"]},${${"\x47L\x4f\x42\x41\x4c\x53"}["\x6cy\x66opxi\x71g"]})){${${"GL\x4fB\x41\x4cS"}["\x6e\x6ab\x65l\x65\x65d"]}="go\x6f\x64";}else{die("D\x6fm\x61i\x6e\x20\x20 $domain i\x73\x20n\x6ft\x20\x6ci\x63\x65\x6esed pl\x65ase\x20\x63\x6f\x6et\x61\x63\x74\x20\x73\x61\x6c\x65\x73@\x6d\x6f\x64\x6dys\x63\x72\x69p\x74\x2e\x63om");}if(${${"\x47\x4c\x4f\x42\x41\x4cS"}["\x6e\x6f\x63\x62\x6cvms\x71\x6ab\x76"]}["sourc\x65_\x69\x64"]==3){${"\x47LOBAL\x53"}["\x73\x61\x61\x6ejs\x66\x6a\x78\x64\x79s"]="\x73\x74\x61t\x75\x73";define("\x50\x48\x50\x4d\x45\x4cO\x44\x59",true);$yjvgkoq="\x76\x69\x64\x65o";include("\x61\x64m\x69n\x2f\x73\x72c/\x79o\x75t\x75b\x65\x2e\x70h\x70");${${"\x47L\x4f\x42\x41\x4c\x53"}["\x62\x6c\x66\x78\x6er\x63\x62\x77y"]}=get_info("\x68t\x74p\x3a\x2f\x2fww\x77\x2ey\x6fu\x74\x75be\x2ec\x6fm\x2f\x77\x61\x74\x63\x68\x3fv\x3d".${$yjvgkoq}["y\x74\x5fi\x64"]);if(strpos(${${"\x47L\x4fBA\x4c\x53"}["bl\x66\x78n\x72\x63b\x77\x79"]}[0],"x\x6dl")!==FALSE){${"GL\x4f\x42\x41L\x53"}["\x75\x6akp\x67i\x64\x6c\x74\x68l"]="\x61r\x72_len\x67\x74\x68";$ddfegmqundg="\x69";${${"G\x4c\x4fB\x41\x4c\x53"}["uj\x6b\x70\x67\x69\x64\x6ct\x68\x6c"]}=count(${${"\x47\x4c\x4f\x42\x41L\x53"}["\x62\x6c\x66\x78\x6er\x63\x62\x77y"]});for(${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x65\x6a\x6c\x75k\x76p\x68i\x6a\x77"]}=0;${$ddfegmqundg}<${${"\x47L\x4f\x42A\x4cS"}["\x70\x6a\x78\x6c\x74\x68\x6d"]};${${"G\x4cOBA\x4cS"}["\x65\x6aluk\x76\x70\x68i\x6aw"]}++){$mrypuzlhin="\x76i\x64\x65\x6f_\x64\x61t\x61";$rwdsrova="\x69";$jqewgzskdk="i";$rdgvdeplky="vi\x64eo\x5f\x64\x61\x74a";${"\x47L\x4f\x42\x41\x4cS"}["\x75myb\x65\x6b"]="\x69";${${"\x47\x4c\x4f\x42\x41L\x53"}["\x62\x6cf\x78\x6er\x63\x62\x77y"]}[${${"\x47\x4cOB\x41\x4cS"}["\x65\x6al\x75\x6bv\x70h\x69j\x77"]}]=str_replace(array("\n","\t","\r"),"",${$mrypuzlhin}[${$rwdsrova}]);if(preg_match("\x2f\x3cy\x74:\x6e\x6f\x65\x6dbed/",${${"G\x4c\x4f\x42A\x4c\x53"}["b\x6cfxn\x72\x63\x62\x77y"]}[${${"\x47\x4c\x4f\x42\x41\x4cS"}["\x75m\x79\x62e\x6b"]}])!=0){${${"G\x4cO\x42\x41\x4cS"}["\x79\x79\x75\x73\x6dpm\x6e\x79"]}="\x55\x4e\x45M\x42ED\x41\x42\x4cE";break;}if(preg_match("\x2f<\x79t:\x70r\x69vat\x65\x2f",${${"GL\x4fB\x41\x4c\x53"}["b\x6cfx\x6er\x63\x62\x77\x79"]}[${${"\x47L\x4f\x42\x41\x4cS"}["ej\x6cu\x6bvp\x68i\x6a\x77"]}])!=0){${${"\x47LOB\x41\x4c\x53"}["yy\x75\x73\x6d\x70\x6d\x6e\x79"]}="\x50R\x49\x56A\x54E";break;}if(preg_match("\x2f<m\x65\x64\x69\x61:\x72\x65stri\x63\x74i\x6fn(.*?)\x3e/",${${"G\x4c\x4f\x42\x41L\x53"}["\x62\x6c\x66\x78\x6e\x72cb\x77\x79"]}[${${"G\x4c\x4f\x42AL\x53"}["\x65\x6alu\x6b\x76\x70\x68i\x6a\x77"]}])!=0){${${"G\x4c\x4f\x42\x41\x4cS"}["\x79\x79\x75s\x6dpm\x6ey"]}="R\x45S\x54R\x49\x43\x54\x45\x44";break;}if(preg_match("/\x3c\x79\x74\x3a\x73ta\x74e \x6e\x61\x6de\x3d'\x28rest\x72\x69\x63\x74ed\x7cd\x65\x6ceted\x7crejected|\x66aile\x64\x29\x27 \x72easo\x6eCod\x65\x3d'\x28\x2e\x2a?)'\x28.*)>(\x2e*?\x29\x3c\x5c\x2fyt:\x73ta\x74\x65>\x2f",${$rdgvdeplky}[${$jqewgzskdk}],${${"\x47L\x4f\x42AL\x53"}["\x6e\x6d\x68ck\x78\x6e\x74"]})!=0){${"\x47L\x4fB\x41L\x53"}["\x6b\x68\x63w\x6f\x78\x79"]="\x72\x65\x61\x73\x6f\x6e";${"G\x4cOB\x41L\x53"}["fo\x64\x70o\x73\x61\x6c\x67\x63"]="v\x69de\x6f";$vblitjgnexn="\x6da\x74c\x68\x65\x73";${${"\x47\x4c\x4f\x42\x41\x4cS"}["\x79\x79\x75\x73\x6dp\x6dn\x79"]}=(${$vblitjgnexn}[1]=="d\x65\x6ceted")?"DEL\x45\x54E\x44":"\x52\x45S\x54RICTED";${"\x47\x4c\x4f\x42A\x4cS"}["\x75\x6c\x6e\x65sa\x6d\x6f"]="\x6d\x61\x74\x63he\x73";${${"\x47LOB\x41L\x53"}["\x6bh\x63\x77ox\x79"]}=${${"GL\x4fBAL\x53"}["\x66\x6f\x64\x70os\x61\x6c\x67\x63"]}["\x75n\x69q_i\x64"]."\x3a ".${${"G\x4c\x4f\x42\x41\x4c\x53"}["\x75\x6cn\x65\x73\x61\x6d\x6f"]}[count(${${"\x47\x4c\x4fB\x41\x4c\x53"}["nm\x68\x63\x6b\x78\x6e\x74"]})-1];break;}}}else{${${"\x47\x4c\x4f\x42ALS"}["\x79\x79\x75\x73\x6d\x70\x6dny"]}="\x44E\x4c\x45\x54ED";}if(!${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x79\x79\x75\x73m\x70\x6dny"]}){$qlqwas="\x73t\x61\x74u\x73";${$qlqwas}=VS_OK;}$smarty->assign("\x56S_\x53\x54A\x54\x55\x53",${${"G\x4c\x4f\x42\x41\x4cS"}["\x73a\x61n\x6as\x66\x6a\x78d\x79\x73"]});}
?> |
|
|
|
|
|
|
Re: please help me to decode this |
|
Posted: Fri Feb 22, 2013 6:06 pm |
|
|
vv456 |
Advanced user |
|
|
Joined: Aug 24, 2012 |
Posts: 190 |
|
|
|
|
|
|
|
sarvnaa wrote: | <?php $sxcxxmrwc="\x6c\x69\x63\x65\x6es\x65\x64";${"\x47L\x4fB\x41LS"}["\x6e\x6a\x62el\x65e\x64"]="\x74\x68\x69\x73s\x73";${"\x47\x4c\x4f\x42ALS"}["\x6cy\x66\x6f\x70x\x69q\x67"]="\x6c\x69c\x65\x6e\x73\x65d";${"GL\x4f\x42A\x4cS"}["\x70j\x78l\x74\x68\x6d"]="\x61r\x72_\x6c\x65\x6eg\x74h";${"G\x4cOB\x41\x4cS"}["y\x79\x75sm\x70\x6d\x6ey"]="s\x74a\x74\x75s";${"G\x4cO\x42\x41\x4c\x53"}["\x69\x74\x78\x72\x77vgi\x62\x63\x72\x76"]="\x64o\x6d\x61\x69\x6e";${"GL\x4f\x42\x41\x4cS"}["\x65\x6a\x6cuk\x76\x70\x68\x69\x6a\x77"]="i";${"\x47\x4cO\x42ALS"}["\x6e\x6f\x63\x62\x6c\x76\x6d\x73qj\x62\x76"]="\x76ide\x6f";${${"G\x4c\x4fBA\x4cS"}["\x69tx\x72\x77\x76\x67\x69\x62\x63\x72\x76"]}=preg_replace("\x2f\x5e(\x2e*\\\x2e)?([\x5e.]*\x5c..\x2a\x29\x24\x2f","\x24\x32",$_SERVER["\x48\x54\x54P\x5f\x48O\x53T"]);${"\x47\x4c\x4f\x42A\x4cS"}["\x6em\x68c\x6b\x78n\x74"]="\x6d\x61\x74\x63h\x65s";${$sxcxxmrwc}="bh\x61r\x61t\x63\x68an\x6e\x65l\x73\x2e\x63o\x6d";${"\x47\x4c\x4f\x42\x41L\x53"}["b\x6cf\x78\x6e\x72\x63\x62wy"]="\x76i\x64\x65o\x5f\x64a\x74a";if(stristr(${${"\x47\x4cOB\x41\x4c\x53"}["\x69\x74\x78r\x77\x76g\x69\x62c\x72\x76"]},${${"\x47L\x4f\x42\x41\x4c\x53"}["\x6cy\x66opxi\x71g"]})){${${"GL\x4fB\x41\x4cS"}["\x6e\x6ab\x65l\x65\x65d"]}="go\x6f\x64";}else{die("D\x6fm\x61i\x6e\x20\x20 $domain i\x73\x20n\x6ft\x20\x6ci\x63\x65\x6esed pl\x65ase\x20\x63\x6f\x6et\x61\x63\x74\x20\x73\x61\x6c\x65\x73@\x6d\x6f\x64\x6dys\x63\x72\x69p\x74\x2e\x63om");}if(${${"\x47\x4c\x4f\x42\x41\x4cS"}["\x6e\x6f\x63\x62\x6cvms\x71\x6ab\x76"]}["sourc\x65_\x69\x64"]==3){${"\x47LOBAL\x53"}["\x73\x61\x61\x6ejs\x66\x6a\x78\x64\x79s"]="\x73\x74\x61t\x75\x73";define("\x50\x48\x50\x4d\x45\x4cO\x44\x59",true);$yjvgkoq="\x76\x69\x64\x65o";include("\x61\x64m\x69n\x2f\x73\x72c/\x79o\x75t\x75b\x65\x2e\x70h\x70");${${"\x47L\x4f\x42\x41\x4c\x53"}["\x62\x6c\x66\x78\x6er\x63\x62\x77y"]}=get_info("\x68t\x74p\x3a\x2f\x2fww\x77\x2ey\x6fu\x74\x75be\x2ec\x6fm\x2f\x77\x61\x74\x63\x68\x3fv\x3d".${$yjvgkoq}["y\x74\x5fi\x64"]);if(strpos(${${"\x47L\x4fBA\x4c\x53"}["bl\x66\x78n\x72\x63b\x77\x79"]}[0],"x\x6dl")!==FALSE){${"GL\x4f\x42\x41L\x53"}["\x75\x6akp\x67i\x64\x6c\x74\x68l"]="\x61r\x72_len\x67\x74\x68";$ddfegmqundg="\x69";${${"G\x4c\x4fB\x41\x4c\x53"}["uj\x6b\x70\x67\x69\x64\x6ct\x68\x6c"]}=count(${${"\x47\x4c\x4f\x42\x41L\x53"}["\x62\x6c\x66\x78\x6er\x63\x62\x77y"]});for(${${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x65\x6a\x6c\x75k\x76p\x68i\x6a\x77"]}=0;${$ddfegmqundg}<${${"\x47L\x4f\x42A\x4cS"}["\x70\x6a\x78\x6c\x74\x68\x6d"]};${${"G\x4cOBA\x4cS"}["\x65\x6aluk\x76\x70\x68i\x6aw"]}++){$mrypuzlhin="\x76i\x64\x65\x6f_\x64\x61t\x61";$rwdsrova="\x69";$jqewgzskdk="i";$rdgvdeplky="vi\x64eo\x5f\x64\x61\x74a";${"\x47L\x4f\x42\x41\x4cS"}["\x75myb\x65\x6b"]="\x69";${${"\x47\x4c\x4f\x42\x41L\x53"}["\x62\x6cf\x78\x6er\x63\x62\x77y"]}[${${"\x47\x4cOB\x41\x4cS"}["\x65\x6al\x75\x6bv\x70h\x69j\x77"]}]=str_replace(array("\n","\t","\r"),"",${$mrypuzlhin}[${$rwdsrova}]);if(preg_match("\x2f\x3cy\x74:\x6e\x6f\x65\x6dbed/",${${"G\x4c\x4f\x42A\x4c\x53"}["b\x6cfxn\x72\x63\x62\x77y"]}[${${"\x47\x4c\x4f\x42\x41\x4cS"}["\x75m\x79\x62e\x6b"]}])!=0){${${"G\x4cO\x42\x41\x4cS"}["\x79\x79\x75\x73\x6dpm\x6e\x79"]}="\x55\x4e\x45M\x42ED\x41\x42\x4cE";break;}if(preg_match("\x2f<\x79t:\x70r\x69vat\x65\x2f",${${"GL\x4fB\x41\x4c\x53"}["b\x6cfx\x6er\x63\x62\x77\x79"]}[${${"\x47L\x4f\x42\x41\x4cS"}["ej\x6cu\x6bvp\x68i\x6a\x77"]}])!=0){${${"\x47LOB\x41\x4c\x53"}["yy\x75\x73\x6d\x70\x6d\x6e\x79"]}="\x50R\x49\x56A\x54E";break;}if(preg_match("\x2f<m\x65\x64\x69\x61:\x72\x65stri\x63\x74i\x6fn(.*?)\x3e/",${${"G\x4c\x4f\x42\x41L\x53"}["\x62\x6c\x66\x78\x6e\x72cb\x77\x79"]}[${${"G\x4c\x4f\x42AL\x53"}["\x65\x6alu\x6b\x76\x70\x68i\x6a\x77"]}])!=0){${${"G\x4c\x4f\x42\x41\x4cS"}["\x79\x79\x75s\x6dpm\x6ey"]}="R\x45S\x54R\x49\x43\x54\x45\x44";break;}if(preg_match("/\x3c\x79\x74\x3a\x73ta\x74e \x6e\x61\x6de\x3d'\x28rest\x72\x69\x63\x74ed\x7cd\x65\x6ceted\x7crejected|\x66aile\x64\x29\x27 \x72easo\x6eCod\x65\x3d'\x28\x2e\x2a?)'\x28.*)>(\x2e*?\x29\x3c\x5c\x2fyt:\x73ta\x74\x65>\x2f",${$rdgvdeplky}[${$jqewgzskdk}],${${"\x47L\x4f\x42AL\x53"}["\x6e\x6d\x68ck\x78\x6e\x74"]})!=0){${"\x47L\x4fB\x41L\x53"}["\x6b\x68\x63w\x6f\x78\x79"]="\x72\x65\x61\x73\x6f\x6e";${"G\x4cOB\x41L\x53"}["fo\x64\x70o\x73\x61\x6c\x67\x63"]="v\x69de\x6f";$vblitjgnexn="\x6da\x74c\x68\x65\x73";${${"\x47\x4c\x4f\x42\x41\x4cS"}["\x79\x79\x75\x73\x6dp\x6dn\x79"]}=(${$vblitjgnexn}[1]=="d\x65\x6ceted")?"DEL\x45\x54E\x44":"\x52\x45S\x54RICTED";${"\x47\x4c\x4f\x42A\x4cS"}["\x75\x6c\x6e\x65sa\x6d\x6f"]="\x6d\x61\x74\x63he\x73";${${"\x47LOB\x41L\x53"}["\x6bh\x63\x77ox\x79"]}=${${"GL\x4fBAL\x53"}["\x66\x6f\x64\x70os\x61\x6c\x67\x63"]}["\x75n\x69q_i\x64"]."\x3a ".${${"G\x4c\x4f\x42\x41\x4c\x53"}["\x75\x6cn\x65\x73\x61\x6d\x6f"]}[count(${${"\x47\x4c\x4fB\x41\x4c\x53"}["nm\x68\x63\x6b\x78\x6e\x74"]})-1];break;}}}else{${${"\x47\x4c\x4f\x42ALS"}["\x79\x79\x75\x73\x6d\x70\x6dny"]}="\x44E\x4c\x45\x54ED";}if(!${${"\x47\x4c\x4f\x42A\x4c\x53"}["\x79\x79\x75\x73m\x70\x6dny"]}){$qlqwas="\x73t\x61\x74u\x73";${$qlqwas}=VS_OK;}$smarty->assign("\x56S_\x53\x54A\x54\x55\x53",${${"G\x4c\x4f\x42\x41\x4cS"}["\x73a\x61n\x6as\x66\x6a\x78d\x79\x73"]});}
?> |
decoded
http://pastebin.com/s9L2R8Fj |
|
|
|
|
|
www.waraxe.us Forum Index -> Php
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|